Overview 50 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 10 public PoC · 1 EPSS ≥ 0.5
50matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
10public PoC20.0%
1EPSS ≥ 0.52.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
2.0%
Not applicable
49
98.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
50
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
8
16.0%
Proof of concept only
2
4.0%
Forecast only
0
0.0%
No public exploit
40
80.0%
split by
peak 8 / year
19991
Not applicable1
Medium1
not blocked1
No public exploit1
20007
Not applicable7
Medium7
not blocked7
Working exploit published2
No public exploit5
20018
Not applicable8
Medium8
not blocked8
Working exploit published1
No public exploit7
20022
Not applicable2
Medium2
not blocked2
No public exploit2
20031
Not applicable1
Medium1
not blocked1
Working exploit published1
20042
Not applicable2
Medium2
not blocked2
No public exploit2
20051
Not applicable1
Medium1
not blocked1
Working exploit published1
20061
Not applicable1
Medium1
not blocked1
No public exploit1
20070
20082
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20094
Not applicable4
Medium4
not blocked4
Working exploit published2
No public exploit2
20100
20110
20122
Not applicable2
Medium2
not blocked2
No public exploit2
20130
20144
Not applicable4
Medium4
not blocked4
No public exploit4
20150
20160
20170
20180
20193
Not applicable3
Medium3
not blocked3
No public exploit3
20204
Not applicable4
Medium4
not blocked4
No public exploit4
20212
Outside Waratek scope1
Not applicable1
Medium2
not blocked2
Proof of concept only2
20221
Not applicable1
Medium1
not blocked1
No public exploit1
20230
20241
Not applicable1
Medium1
not blocked1
No public exploit1
20254
Not applicable4
Medium4
not blocked4
No public exploit4
200120042007201020132016201920222025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-2028 | Medium | 2025-08-06 | Not applicable | No public exploit | Lack of TLS validation when downloading a CSV file including mapping from IPs to countries used ONLY for displaying country flags in logs |
| CVE-2024-52885 | Medium | 2025-08-06 | Not applicable | No public exploit | The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticated, malicious end-user (authorized to at least one File Share application) to list the file names of 'nobody'-accessible directories on the Mobile Access gateway. |
| CVE-2024-52888 | Medium | 2025-04-27 | Not applicable | No public exploit | For an authenticated end-user the portal may run a script while attempting to display a directory or some file's properties. |
| CVE-2024-52887 | Medium | 2025-04-27 | Not applicable | No public exploit | Authenticated end-user may set a specially crafted SNX bookmark that can make their browser run a script while accessing their own bookmark list. |
| CVE-2024-24912 | Medium | 2024-05-01 | Not applicable | No public exploit | A local privilege escalation vulnerability has been identified in Harmony Endpoint Security Client for Windows versions E88.10 and below. To exploit this vulnerability, an attacker must first obtain the ability to execute local privileged code on the target system. |
| CVE-2021-30361 | Medium | 2022-05-11 | Not applicable | No public exploit | The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to inject a command that would run on the Gaia OS. |
| CVE-2021-30357 | Medium | 2021-06-08 | Not applicable | Proof of concept only | SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing files to which the user did not have access. |
| CVE-2021-3449 | Medium | 2021-03-25 | Outside Waratek scope | Proof of concept only | An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j). |
| CVE-2020-6015 | Medium | 2020-11-05 | Not applicable | No public exploit | Check Point Endpoint Security for Windows before E84.10 can reach denial of service during clean install of the client which will prevent the storage of service log files in non-standard locations. |
| CVE-2020-6014 | Medium | 2020-11-02 | Not applicable | No public exploit | Check Point Endpoint Security Client for Windows, with Anti-Bot or Threat Emulation blades installed, before version E83.20, tries to load a non-existent DLL during a query for the Domain Name. An attacker with administrator privileges can leverage this to gain code execution within a Check Point Software Technologies signed binary, where under certain circumstances may cause the client to terminate. |
| CVE-2020-6022 | Medium | 2020-10-27 | Not applicable | No public exploit | Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to delete arbitrary files while restoring files in Anti-Ransomware. |
| CVE-2020-6020 | Medium | 2020-09-24 | Not applicable | No public exploit | Check Point Security Management's Internal CA web management before Jumbo HFAs R80.10 Take 278, R80.20 Take 160, R80.30 Take 210, and R80.40 Take 38, can be manipulated to run commands as a high privileged user or crash, due to weak input validation on inputs by a trusted management administrator. |
| CVE-2019-8458 | Medium | 2019-06-20 | Not applicable | No public exploit | Check Point Endpoint Security Client for Windows, with Anti-Malware blade installed, before version E81.00, tries to load a non-existent DLL during an update initiated by the UI. An attacker with administrator privileges can leverage this to gain code execution within a Check Point Software Technologies signed binary, where under certain circumstances may cause the client to terminate. |
| CVE-2019-8453 | Medium | 2019-04-17 | Not applicable | No public exploit | Some of the DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are taken from directories where all users have write permissions. This can allow a local attacker to replace a DLL file with a malicious one and cause Denial of Service to the client. |
| CVE-2019-8456 | Medium | 2019-04-09 | Not applicable | No public exploit | Check Point IKEv2 IPsec VPN up to R80.30, in some less common conditions, may allow an attacker with knowledge of the internal configuration and setup to successfully connect to a site-to-site VPN server. |
| CVE-2014-1673 | Medium | 2014-01-26 | Not applicable | No public exploit | Check Point Session Authentication Agent allows remote attackers to obtain sensitive information (user credentials) via unspecified vectors. |
| CVE-2014-1672 | Medium | 2014-01-26 | Not applicable | No public exploit | Check Point R75.47 Security Gateway and Management Server does not properly enforce Anti-Spoofing when the routing table is modified and the "Get - Interfaces with Topology" action is performed, which allows attackers to bypass intended access restrictions. |
| CVE-2013-7311 | Medium | 2014-01-23 | Not applicable | No public exploit | The OSPF implementation in Check Point Gaia OS R75.X and R76 and IPSO OS 6.2 R75.X and R76 does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149. |
| CVE-2013-7304 | Medium | 2014-01-22 | Not applicable | No public exploit | Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5 does not configure X.509 certificate validation for client devices, which allows man-in-the-middle attackers to spoof SSL servers by presenting an arbitrary certificate during a session established by a client. |
| CVE-2010-5184 | Medium | 2012-08-25 | Not applicable | No public exploit | Race condition in ZoneAlarm Extreme Security 9.1.507.000 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute |
| CVE-2012-2753 | Medium | 2012-06-19 | Not applicable | No public exploit | Untrusted search path vulnerability in TrGUI.exe in the Endpoint Connect (aka EPC) GUI in Check Point Endpoint Security R73.x and E80.x on the VPN blade platform, Endpoint Security VPN R75, Endpoint Connect R73.x, and Remote Access Clients E75.x allows local users to gain privileges via a Trojan horse DLL in the current working directory. |
| CVE-2008-7025 | Medium | 2009-08-21 | Not applicable | Working exploit published | TrueVector in Check Point ZoneAlarm 8.0.020.000, with vsmon.exe running, allows remote HTTP proxies to cause a denial of service (crash) and disable the HIDS module via a crafted response. |
| CVE-2008-7009 | Medium | 2009-08-19 | Not applicable | Working exploit published | Buffer overflow in multiscan.exe in Check Point ZoneAlarm Security Suite 7.0.483.000 and 8.0.020.000 allows local users to execute arbitrary code via a file or directory with a long path. NOTE: some of these details are obtained from third party information. |
| CVE-2008-5994 | Medium | 2009-01-28 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in index.php in Check Point Connectra NGX R62 HFA_01 allows remote attackers to inject arbitrary web script or HTML via the dir parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2008-5849 | Medium | 2009-01-06 | Not applicable | No public exploit | Check Point VPN-1 R55, R65, and other versions, when Port Address Translation (PAT) is used, allows remote attackers to discover intranet IP addresses via a packet with a small TTL, which triggers an ICMP_TIMXCEED_INTRANS (aka ICMP time exceeded in-transit) response containing an encapsulated IP packet with an intranet address, as demonstrated by a TCP packet to the firewall management server on port 18264. |
| CVE-2008-1397 | Medium | 2008-03-20 | Not applicable | No public exploit | Check Point VPN-1 Power/UTM, with NGX R60 through R65 and NG AI R55 software, allows remote authenticated users to cause a denial of service (site-to-site VPN tunnel outage), and possibly intercept network traffic, by configuring the local RFC1918 IP address to be the same as one of this tunnel's endpoint RFC1918 IP addresses, and then using SecuRemote to connect to a network interface at the other endpoint. |
| CVE-2008-1208 | Medium | 2008-03-08 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the login page in Check Point VPN-1 UTM Edge W Embedded NGX 7.0.48x allows remote attackers to inject arbitrary web script or HTML via the user parameter. |
| CVE-2006-3885 | Medium | 2006-07-27 | Not applicable | No public exploit | Directory traversal vulnerability in Check Point Firewall-1 R55W before HFA03 allows remote attackers to read arbitrary files via an encoded .. (dot dot) in the URL on TCP port 18264. |
| CVE-2005-4093 | Medium | 2005-12-08 | Not applicable | Working exploit published | Check Point VPN-1 SecureClient NG with Application Intelligence R56, NG FP1, 4.0, and 4.1 allows remote attackers to bypass security policies by modifying the local copy of the local.scv policy file after it has been downloaded from the VPN Endpoint. |
| CVE-2004-0112 | Medium | 2004-11-23 | Not applicable | No public exploit | The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read. |
| CVE-2004-0081 | Medium | 2004-11-23 | Not applicable | No public exploit | OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool. |
| CVE-2003-0757 | Medium | 2003-10-20 | Not applicable | Working exploit published | Check Point FireWall-1 4.0 and 4.1 before SP5 allows remote attackers to obtain the IP addresses of internal interfaces via certain SecuRemote requests to TCP ports 256 or 264, which leaks the IP addresses in a reply packet. |
| CVE-2002-2405 | Medium | 2002-12-31 | Not applicable | No public exploit | Check Point FireWall-1 4.1 and Next Generation (NG), with UserAuth configured to proxy HTTP traffic only, allows remote attackers to pass unauthorized HTTPS, FTP and possibly other traffic through the firewall. |
| CVE-2002-1623 | Medium | 2002-12-31 | Not applicable | No public exploit | The design of the Internet Key Exchange (IKE) protocol, when using Aggressive Mode for shared secret authentication, does not encrypt initiator or responder identities during negotiation, which may allow remote attackers to determine valid usernames by (1) monitoring responses before the password is supplied or (2) sniffing, as originally reported for FireWall-1 SecuRemote. |
| CVE-2001-1499 | Medium | 2001-12-31 | Not applicable | No public exploit | Check Point VPN-1 4.1SP4 using SecuRemote returns different error messages for valid and invalid users, with prompts that vary depending on the authentication method being used, which makes it easier for remote attackers to conduct brute force attacks. |
| CVE-2001-1431 | Medium | 2001-10-08 | Not applicable | No public exploit | Nokia Firewall Appliances running IPSO 3.3 and VPN-1/FireWall-1 4.1 Service Pack 3, IPSO 3.4 and VPN-1/FireWall-1 4.1 Service Pack 4, and IPSO 3.4 or IPSO 3.4.1 and VPN-1/FireWall-1 4.1 Service Pack 5, when SYN Defender is configured in Active Gateway mode, does not properly rewrite the third packet of a TCP three-way handshake to use the NAT IP address, which allows remote attackers to gain sensitive information. |
| CVE-2001-1102 | Medium | 2001-09-08 | Not applicable | No public exploit | Check Point FireWall-1 3.0b through 4.1 for Solaris allows local users to overwrite arbitrary files via a symlink attack on temporary policy files that end in a .cpp extension, which are set world-writable. |
| CVE-2001-1101 | Medium | 2001-09-08 | Not applicable | No public exploit | The Log Viewer function in the Check Point FireWall-1 GUI for Solaris 3.0b through 4.1 SP2 does not check for the existence of '.log' files when saving files, which allows (1) remote authenticated users to overwrite arbitrary files ending in '.log', or (2) local users to overwrite arbitrary files via a symlink attack. |
| CVE-2000-1201 | Medium | 2001-08-31 | Not applicable | No public exploit | Check Point FireWall-1 allows remote attackers to cause a denial of service (high CPU) via a flood of packets to port 264. |
| CVE-2001-0682 | Medium | 2001-08-29 | Not applicable | No public exploit | ZoneAlarm and ZoneAlarm Pro allows a local attacker to cause a denial of service by running a trojan to initialize a ZoneAlarm mutex object which prevents ZoneAlarm from starting. |
| CVE-2001-1303 | Medium | 2001-07-18 | Not applicable | Working exploit published | The default configuration of SecuRemote for Check Point Firewall-1 allows remote attackers to obtain sensitive configuration information for the protected network without authentication. |
| CVE-2001-0182 | Medium | 2001-03-26 | Not applicable | No public exploit | FireWall-1 4.1 with a limited-IP license allows remote attackers to cause a denial of service by sending a large number of spoofed IP packets with various source addresses to the inside interface, which floods the console with warning messages and consumes CPU resources. |
| CVE-2000-1032 | Medium | 2000-12-11 | Not applicable | No public exploit | The client authentication interface for Check Point Firewall-1 4.0 and earlier generates different error messages for invalid usernames versus invalid passwords, which allows remote attackers to identify valid usernames on the firewall. |
| CVE-2000-0813 | Medium | 2000-11-14 | Not applicable | No public exploit | Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to redirect FTP connections to other servers ("FTP Bounce") via invalid FTP commands that are processed improperly by FireWall-1, aka "FTP Connection Enforcement Bypass." |
| CVE-2000-0809 | Medium | 2000-11-14 | Not applicable | No public exploit | Buffer overflow in Getkey in the protocol checker in the inter-module communication mechanism in Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to cause a denial of service. |
| CVE-2000-0806 | Medium | 2000-11-14 | Not applicable | No public exploit | The inter-module authentication mechanism (fwa1) in Check Point VPN-1/FireWall-1 4.1 and earlier may allow remote attackers to conduct a denial of service, aka "Inter-module Communications Bypass." |
| CVE-2000-0582 | Medium | 2000-06-30 | Not applicable | Working exploit published | Check Point FireWall-1 4.0 and 4.1 allows remote attackers to cause a denial of service by sending a stream of invalid commands (such as binary zeros) to the SMTP Security Server proxy. |
| CVE-2000-0482 | Medium | 2000-06-06 | Not applicable | Working exploit published | Check Point Firewall-1 allows remote attackers to cause a denial of service by sending a large number of malformed fragmented IP packets. |
| CVE-2000-0181 | Medium | 2000-03-11 | Not applicable | No public exploit | Firewall-1 3.0 and 4.0 leaks packets with private IP address information, which could allow remote attackers to determine the real IP address of the host that is making the connection. |
| CVE-1999-0675 | Medium | 1999-08-09 | Not applicable | No public exploit | Check Point FireWall-1 can be subjected to a denial of service via UDP packets that are sent through VPN-1 to port 0 of a host. |